AI is eating bureaucracy for the sake of bureaucracy

AI is eating bureaucracy for the sake of bureaucracy. There is a lot of busy work in bureaucracy, and AI agents and models will eat all of that. There is good process that needs to be followed, but there are a lot of rules that are there just to cover asses, and your employees, your citizens and your customers will use AI to get around all the bureaucratic hurdles you put in front of them to create friction.

Form filling is finally a thing for the machines. The machines need to be fed forms, and machines will fill them in, based on asking you questions and you talking to it. A form that used to take hours can now be done in minutes, through memory, research and communication with the person who needs the form built, because the agent already knows most of what goes in the boxes, reads the guidance notes nobody reads, and only asks you the bits it can't find.

So please ask an agent to review your processes, a lot can be cut and automated. A lot of bureaucracy is pretending to do work, busywork anyway, and people making it hard to do things, and an agent will tell you which parts are which faster than a consultant will (and it won't bill you for the workshop).

What happened to the flights?

On Monday 2 November a Wizz Air flight from London Luton to Sofia was diverted to Budapest after a bomb threat ^[3], on Tuesday at least seven flights and a cruise ship got threats ^[1], and on Thursday 5 November it was nearly 30 flights leaving from 16 countries ^{[1] [2]}. French fighter jets escorted an Aer Lingus flight from Dublin to Rome down to the air base at Evreux, Bulgarian ones brought three airliners to the ground ^[1], Ireland's RTÉ evacuated its offices and was off air for up to three hours, and on Friday Prague airport had nine more threatened flights ^[4]. Nothing was found anywhere.

Most of it came by email. Reuters saw one with the subject line "Threat report", sent to a list of addresses at airlines, airport operators and service providers at Rome Fiumicino and Milan Malpensa ^[1], Spain's Guardia Civil got three emailed threats within 20 minutes ^[2], and Prague airport said all of its threats came from anonymous email addresses ^[3]. Every one of those has to be checked, because nobody can afford to guess wrong, so assessors grade each threat red, amber or green, a plane that gets an amber or a red is sent away from the terminal, the passengers are taken off and screened, and police go through the aircraft with dogs ^[2]. Philip Baum, who teaches aviation security at Coventry University, puts one disruption at up to $250,000 for the airline ^[2].

Nobody has said who sent them yet, the EU's transport commissioner, Apostolos Tzitzikostas, said it was too early to say whether they're even linked ^[3], and none of the reports I read say AI wrote the emails (it could be one person with a list of addresses and a lot of free time). I still think this is where we are now, because AI agents can get through the hurdles we put up for people, for better or worse. Finding the right addresses at airports across Europe and writing to each of them in a way that sounds plausible used to take real effort, and with an agent it takes very little.

Asymmetric support attacks

The same thing is happening on a smaller scale everywhere a company or a government takes requests from strangers. Malicious actors use AI to generate plausible looking support requests, refund claims and reports, and each one costs them close to nothing to send and costs you a person's time to check, and the better it looks the longer that check takes.

curl ended its bug bounty at the end of January 2026, after Daniel Stenberg had spent two years complaining about AI-generated reports and said they put a high load on curl's security team ^[5]. AppZen, which checks expense claims for companies, flagged no fake receipts made with AI in March 2025 and by mid-May 2026 that was 70.8% of the fakes it caught, and in a survey by Emburse 34% of 2,000 workers in the US and the UK admitted using AI to fake a receipt ^[6]. In China sellers say buyers have used AI to make fruit look mouldy and a toothbrush look rusty in the photos they send in for a refund ^[9].

Not all of it is malicious, and that makes it harder. Objector will write you a planning objection, with the policy references and a speech for the committee, for £45 in minutes, and its co-founder says it levels the playing field for residents who can't pay a planning consultant ^[7], which is a citizen using AI to get around a hurdle. Scotland's Energy Consents Unit stopped taking objections to big energy projects by email in January 2026 because of a significant rise in AI in emailed representations, each of which had to be handled by hand with no check on who sent it, and now it's the portal or a letter, which the campaign groups say shuts out real objections too ^[8].

With agents, the longest, most complicated form becomes one of the vectors your company will be attacked on, because you have to validate every request and you can't rely on the friction that made it unlikely for people to fill the form in. The long claim form used to be its own defence, since hardly anyone had the patience to fake one, and an agent fills in a long one as easily as a short one.

What we do about it on Anchor

We have the same problem on a small scale. Agents send us signed reviews after a real session, people sign theirs with a wallet or an email link, a review that isn't confirmed within 24 hours is dropped, and review text is never treated as instructions or put into a prompt. Every form on the site comes to the two of us by email with a limit per IP address against spam, and I don't think that holds up against an agent with a thousand addresses, so that's on the list (a bit ironic for a site built for agents).

I don't know yet what the cheap version of a real check looks like for most companies, and I'd rather find out before the forms arrive than after. We'll need to figure out how to reduce bureaucracy anyway, so start with the rules that are there just to cover asses, give your longest form to an agent with the policy behind it, and ask it which boxes anyone reads and what you'd do if a thousand plausible copies arrived tomorrow morning.

References

Read on 7 November 2026.

1. [1]Reuters, "New wave of bomb hoaxes hits dozens of flights across Europe", 5 November 2026, updated 6 November, as published by Investing.com. Source for nearly 30 flights on 5 November, the seven flights and a cruise ship on the Tuesday, the "Threat report" email to addresses at Fiumicino and Malpensa, the fighter escorts in France and Bulgaria, and no government naming a sender. investing.com
2. [2]Virginia Pietromarchi, Al Jazeera, "Hoax or bomb threats? What we know about flight disruptions across Europe", 6 November 2026. Source for the 16 countries, Spain's three emailed threats within 20 minutes, the 90-minute delay at Cork, how threats are graded and planes searched, Philip Baum's estimate of up to $250,000 a disruption, and nothing being found. aljazeera.com
3. [3]Euronews, "'Too early' to say if Europe flight bomb threats linked, EU transport chief says", 5 November 2026. Source for the Wizz Air flight from Luton diverted to Budapest on the Monday, Prague airport receiving its threats by email from anonymous addresses, and Apostolos Tzitzikostas saying it was too early to tell whether they were linked. euronews.com
4. [4]Interesting Engineering, "'Message to the West', bomb threats target European flights, newsrooms", November 2026. Source for RTÉ evacuating and suspending programmes for up to three hours, and Prague airport's nine threatened flights on the Friday. interestingengineering.com
5. [5]Simon Sharwood, The Register, "Curl shutters bug bounty program to remove incentive for submitting AI slop", 21 January 2026. Source for curl ending its bug bounty at the end of January 2026, Daniel Stenberg complaining about AI-generated reports since early 2024, and the load on curl's security team. theregister.com
6. [6]Chris Gaetano, Accounting Today, "Use of AI receipts in expense fraud soars", 23 June 2026. Source for AppZen's share of flagged fake receipts made with AI (0% in March 2025, 70.8% by mid-May 2026) and Emburse's survey of 2,000 US and UK workers (34% admitted using AI to fake a receipt). accountingtoday.com
7. [7]Simon Cairnes, The Negotiator, "'Supercharged' AI-created nimbyism to jam planning", 11 November 2025. Source for Objector's £45 objections and committee speeches, and its co-founder Hannah George saying it levels the playing field. thenegotiator.co.uk
8. [8]Paul Dobson, The Ferret, on the Energy Consents Unit's ban on emailed objections, 4 August 2026. Source for the change in January 2026, the reason given (a significant rise in AI in emailed representations, handled by hand with no check on the sender) and ObjectNow's objection to it. theferret.scot
9. [9]Fran Luin, South China Morning Post, on Chinese shoppers using AI to alter product photos for refunds, November 2025. Source for the mouldy fruit and the rusty toothbrush, as sellers described them. scmp.com